Frédéric Buclin

The issue allows remote attackers to conduct clickjacking attacks via a crafted web site that uses the HTTP server push feature with multipart responses, due to the improper enforcement of the X-Frame-Options protection mechanism.

The issue allows remote attackers to obtain sensitive information by reading HTML source code, specifically in circumstances involving custom-field visibility control. This occurs because the `template/en/default/bug/field-events.js.tmpl` file generates JavaScript function calls containing private product names or private component names.

The issue concerns the User.get method in Bugzilla, where the outcome of a groups request differs based on the existence of a group. This discrepancy allows remote authenticated users to determine private group names by observing whether a call results in an error.

The issue allows remote attackers to read attachment descriptions from private bugs. This is achieved via an obsolete=1 insert action in the attachment.cgi script.

The issue allows remote attackers to potentially inject data into an LDAP directory via a crafted login attempt due to the lack of character restriction in usernames.

The issue allows remote attackers to read sensitive files due to insufficient access control. This includes (1) template files, (2) custom extension files under the `extensions/` directory, or (3) custom documentation files under the `docs/` directory via a direct request.

The issue concerns the `get attachment link` function in `Template.pm`, which fails to check if an attachment is private before displaying its description in a public comment. This allows remote attackers to obtain sensitive information by reading a comment.

The issue allows remote attackers to obtain sensitive description information by reading the tooltip portions of an HTML e-mail message. This occurs because Bugzilla uses bug-editor privileges instead of bugmail-recipient privileges during the construction of HTML bugmail documents.

The issue arises from the improper handling of duplicate values in X-Frame-Options headers, making it easier for remote attackers to conduct clickjacking attacks via a FRAME element referencing a web site that produces these duplicate values.

The issue arises from the User.offer account by email WebService method, which does not properly handle user can create account settings when createemailregexp is not empty. This allows remote attackers to create user accounts by leveraging a token contained in an e-mail message.

The issue allows local users to obtain sensitive information by reading temporary files associated with uploaded attachments, which are not deleted.

The issue allows remote attackers to determine the existence of private group names via a crafted parameter during bug creation or bug editing.

CRLF injection vulnerability in chart.cgi in Bugzilla before 3.2.10, 3.4.x before 3.4.10, 3.6.x before 3.6.4, and 4.0.x before 4.0rc2 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the query string, a different vulnerability than CVE-2010-2761 and CVE-2010-4411.

The issue allows remote attackers to determine the group memberships of arbitrary users via vectors involving the Search interface, boolean charts, and group-based pronouns.

The issue allows remote attackers to guess product names via unspecified use of the (1) Reports or (2) Duplicates page, due to different error messages being generated depending on whether a product exists.

The issue allows remote attackers to obtain sensitive information by requesting specific files and directories used by custom installations, including (1) `CVS/`, (2) `contrib/`, (3) `docs/en/xml/`, (4) `t/`, or (5) `old-params.txt`.

The issue allows remote attackers to obtain sensitive information via a request for a bug in certain circumstances, due to the failure to preserve group restrictions when moving a bug to a different product category.

A cross-site request forgery issue allows remote attackers to delete keywords and user preferences via a link or IMG tag to (1) "editkeywords.cgi" or (2) "userprefs.cgi".

The issue allows remote authenticated users to more easily spoof the changer of a bug via a `@reporter` command in the body of an e-mail message. This occurs because the `@reporter` command overrides the e-mail address as normally obtained from the `From` e-mail header. Note that since `From` headers are easily spoofed, this only crosses privilege boundaries in environments that provide additional verification of e-mail addresses.

The issue allows remote authenticated users to inject arbitrary web script or HTML. This can be achieved via page headers using the H1, H2, and H3 HTML tags in global/header.html.tmpl, description fields of certain items in various edit cgi scripts, and the `id` parameter in "showdependencygraph.cgi".